Vulnerabilitycritical
Two Distinct Botnets Exploit Wazuh Server Vulnerability to Launch Mirai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-8361 | Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE | — | 100% | KEV | — KEV |
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability | 8.8 | 78% | ||
| CVE-2017-18368 | Unauthenticated OS Command Injection in Zyxel/Billion TrueOnline Routers | 9.8 | 95% | KEVPoC ×3 | KEV |
| CVE-2023-1389 | Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution | 8.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2024-3721 | TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical: This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the… | 6.3 | 86% | ||
| CVE-2025-24016 | Deserialization RCE in Wazuh Server (CVE-2025-24016) | 9.9 | 94% | KEVPoC | KEV |
From the original article
5 min read at thehackernews.com
A now-patched critical security flaw in the Wazur Server is being exploited by threat actors to drop two different Mirai botnet variants and use them to conduct distributed denial-of-service (DDoS) attacks. Akamai, which first discovered the exploitation efforts in late March 2025, said the malicious campaign targets CVE-2025-24016 (CVSS score: 9.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.